As computer systems become ubiquitous in both the home and industry, the ability for any one individual to access applications and data has increased dramatically. While such ease of access has streamlined many tasks such as paying bills, ordering supplies, and searching for information, it entails a the risk of providing the wrong data or functionality to the wrong person, which can be fatal to an organization. Instances of data breaches at many consumer-product companies and the need to comply with certain statutory measures (e.g., Health Insurance Portability and Accountability Act (HIPAA), Child Online Protection Act (COPA), Sarbanes-Oxley (SOX), etc.) have forced many companies and institutions to implement much stricter system access policies. Healthcare regulations, for example, mandate that “protected health information” (PHI) be accessible only by an authorized caregiver. Proper user authentication is required to access and alter PHI; this not only ensures patient privacy and safety, but also permits changes made to patient records to be audited later. Access restrictions are generally implemented, following user log-in to the system, by controlling access to applications with access to PHI.
A persistent problem with data management in a healthcare environment is the disparate nature of patient information, which can originate with any of various applications. Clinical decision making may require access to patient data from different sources—patient records from the hospital's main server, radiological information or lab results from other servers or an outside providers, prescription information from a pharmacopoeia, drug interactions from a specialized external resource—each of which may require a separate log-in. This inconvenience can be managed in the first instance using a “single sign-on” system, but sharing diversely sourced information remains cumbersome. A clinician who has retrieved various types of clinical data and wishes to consult remotely with a colleague or specialist has no easy way to provide this information directly. Even if the other clinician has already authenticated herself to the same applications as the referring clinician, she must typically retrieve each type of information separately. There is, at present, no easy way for an authorized user to efficiently generate and send disparately sourced information to another authorized user.